package info.sanaulla.demo.service;

/*

http://noahblog.360.cn/vcenter-6-5-7-0-rce-lou-dong-fen-xi/
CVE-2021-21972 vCenter 6.5-7.0 RCE
 */

import org.apache.commons.compress.archivers.tar.TarArchiveEntry;
import org.apache.commons.compress.archivers.tar.TarArchiveInputStream;
import org.apache.commons.io.IOUtils;
import org.springframework.stereotype.Service;
import org.springframework.web.multipart.commons.CommonsMultipartFile;

import java.io.File;
import java.io.FileOutputStream;
import java.io.InputStream;
import java.io.OutputStream;
import java.util.List;

@Service
public class vCenterRCE {

    public void uploadOvaFile(List<CommonsMultipartFile> uploadedFiles) throws Exception {

        for (CommonsMultipartFile uploadFile : uploadedFiles) {
            //log.debug("Multipart storage location {}", multipartFile.getStorageDescription());
            if (!uploadFile.isEmpty()) {
                try {
                    //logger.info("Downloading OVA file has been started");
                    //logger.info("Size of the file received  : " + uploadFile.getSize());
                    InputStream inputStream = uploadFile.getInputStream();
                    File dir = new File("/tmp/unicorn_ova_dir");
                    if (!dir.exists()) {
                        dir.mkdirs();
                    } else {
                        String[] entries = dir.list();
                        String[] var9 = entries;
                        int var10 = entries.length;

                        for (int var11 = 0; var11 < var10; ++var11) {
                            String entry = var9[var11];
                            File currentFile = new File(dir.getPath(), entry);
                            currentFile.delete();
                        }

                        //logger.info("Successfully cleaned : /tmp/unicorn_ova_dir");
                    }

                    TarArchiveInputStream in = new TarArchiveInputStream(inputStream);
                    TarArchiveEntry entry = in.getNextTarEntry();
                    // ArrayList result = new ArrayList();

                    while (entry != null) {
                        if (entry.isDirectory()) {
                            entry = in.getNextTarEntry();
                        } else {
                            File curfile = new File("/tmp/unicorn_ova_dir", entry.getName());
                            File parent = curfile.getParentFile();
                            if (!parent.exists()) {
                                parent.mkdirs();
                            }
                            OutputStream out = new FileOutputStream(curfile);
                            IOUtils.copy(in, out);
                            out.close();
                            //result.add(entry.getName());
                            entry = in.getNextTarEntry();
                        }
                    }
                    in.close();
                } catch (Exception e) {
                    //
                }


            }


        }
    }

}
